twiss

49 ms·

151.
by twiss 3y ago
I think it's because the game is using a different font for each "round" (indicated in the bottom left corner), so there is no consistency across rounds. It would've been easier to learn/guess the "solutions&qu
152.
by twiss 3y ago
We derive a (key-encryption-)key from the password using a password hashing function / key derivation function (bcrypt, although we're planning to switch to Argon2) before using it to encrypt the PGP key. This is fairly standard p
153.
by twiss 3y ago
Yes; we recommended generating a long random password or passphrase :)
154.
by twiss 3y ago
For non-private subusers, you're right, but for private subusers, you can only read new emails after resetting the keys, you can't read existing emails. I.e. you can take control over the email address, but not access existing d
155.
by twiss 3y ago
We support both, it's possible to have private subusers as well (that the account owner can't access the contents of).
156.
by twiss 3y ago
Sure, fair enough. I've edited it to "the server doesn't have access". Also, see https://news.ycombinator.com/item?id=36643922 .
157.
by twiss 3y ago
I assume this was meant in reply to me. I'm not trying to tell users what to do, rather I'm trying to explain the type of usage that Proton was designed in mind with.
158.
by twiss 3y ago
> Thunderbird has PGP built-in, to the point where it's actually got its own key management stuff and everything This postdates Proton Bridge, btw. But yes, probably we could do more to play nicely with it. But, when Bridge was crea
159.
by twiss 3y ago
Yeah. For web, I've been advocating for something like "Source Code Transparency" (somewhat analogous to Certificate Transparency) in the WebAppSec WG at the W3C. The idea would be that if you could verify that the source cod
160.
by twiss 3y ago
Correct, private keys can only be decrypted client-side, the server doesn't have access to the password that they're encrypted with. Otherwise it wouldn't be end-to-end encryption, IMO :)
161.
by twiss 3y ago
It's not entirely trivial because for internal messages we don't store them in PGP/MIME format, for performance reasons (e.g. to make it possible to fetch the body separately from the attachments, or one attachment without th
162.
by twiss 3y ago
Not exactly. The article says: > It’s absurd that there’s no way to disable this, no option to tell Proton “if you see a multipart/signed or multipart/encrypted message, just leave it the hell alone.” which, as I said in my res
163.
by twiss 3y ago
Proton doesn't have the private key material, we store private keys encrypted with the user's password (which we also don't know).
164.
by twiss 3y ago
See my last paragraph :) PS: yes, this is being worked on
165.
by twiss 3y ago
Hi - crypto team lead here. I'll hijack this comment to try to explain what Proton Bridge is intended to do, and why it doesn't work the way OP wants. Bridge is a proxy which hosts a local IMAP and SMTP server, and takes "nor
166.
by twiss 3y ago
That's not his argument; he says defining Θ = e^2πi is not useful because e^2πi = 1, so Θ and Θ^x would also be 1. That's why he defined Θ = e^2π instead, so that Θ^x (or possibly Θ^ix) is a useful operation.
167.
by twiss 3y ago
I agree that car safety and regulations (and probably even more importantly, replacing car trips with safer modes of transport wherever possible) are more pressing than submarine safety regulations, but why does one preclude the other? We s
168.
by twiss 3y ago
Indeed, and even a lot of client side form validation can be done using HTML and CSS: https://developer.mozilla.org/en-US/docs/Learn/Forms/Form_va...
169.
by twiss 3y ago
Those exist now: https://developer.mozilla.org/en-US/docs/Web/API/Element/rem... , https://developer.mozilla.org/en-US/docs/Web/API/Element/pre...
170.
by twiss 3y ago
Yeah, I wasn't referring to bees, but to humans, as the author seems to want humans to follow the example of bees :)
171.
by twiss 3y ago
It's obvious that this is beneficial for the population, but is it (typically) beneficial for an individual? Probably, selfish individuals would only want to try this if they're already well-fed, or if they're confident that
172.
by twiss 4y ago
If you're in Europe, this is easier to read at https://web.archive.org/web/20230414110456/https://www.money...
173.
by twiss 4y ago
According to https://www.weforum.org/reports/global-social-mobility-index... , the US ranks 27th in social mobility, behind 21 European countries, and ahead of 14 of them. On the "Education Access" pillar, the
174.
by twiss 4y ago
> the busiest domestic flight air might be LV<->LA, but that doesn't mean it's a significant amount of domestic traffic. There's apparently 352 flights between the cities each week, I would say it's pretty signi
175.
by twiss 4y ago
What trip is "it" you're referring to that would take 11-20 hours? The busiest domestic US air route is Las Vegas - Los Angeles, which takes only a bit more than an hour. There is an idea to connect them by high-speed rail wh
176.
by twiss 4y ago
Donbas is part of Ukraine. Grandparent isn't claiming that the conflict there is justification for Russia's invasion, rather, it's part of it.
177.
by twiss 4y ago
It's not a physical necessity but it is the economic reality. I don't think the people at Canonical, specifically, should be blamed for the fact that we live in a capitalist society.
178.
by twiss 4y ago
Sectigo might be required to revoke them, then? There doesn't seem to be a requirement for the compromise to be Sectigo's fault, according to my reading of the Baseline Requirements [1]: > The CA SHOULD revoke a certificate wit
179.
Would You Fall for It? [video on 1950’s propaganda](youtube.com)
1 points by twiss 4y ago|0 comments
180.
by twiss 4y ago
Are you https://www.youtube.com/@NotJustBikes ? ;)

More ›